Null is Not Always Empty: Monitoring the Null Space for Field-Level Anomaly Detection in Industrial IoT Environments

Abstract

Industrial environments have vastly changed sincethe conception of initial primitive and isolated networks. Thecurrent full interconnection paradigm, where connectivity be-tween different devices and the Internet has become a businessnecessity, has driven device interconnectivity towards buildingthe Industrial Internet of Things (IIoT), enabling added valueservices such as supply chain optimization or improved processcontrol. However, whereas interconnectivity has increased, IIoTsecurity practices has not evolved at the same pace, due partlyto inherited security practices from when industrial networkswhere not connected and the existence of basic hardware withno security functionalities. In this work, we present an AnomalyDetection System for industrial environments that monitorsphysical quantities to detect intrusions. It is based in the nullspace detection, which is at the same time, based on StochasticSubspace Identification (SSI). The approach is validated usingthe Tennessee-Eastman chemical process.